PII violations can carry stiff penalties

FORT RUCKER, Ala. -- Protecting personally identifiable information can become increasingly difficult as more information and services shift to the online world, but Fort Rucker officials want to remind people that it still comes down to personal responsibility.

PII is any combination of information that can be used to identify a person, according to Sean Sparks, director of Fort Rucker Directorate of Human Resources.

One of the most familiar PII violations is identity theft, said Sparks, adding that when people are careless with information, such as Social Security numbers and people's date of birth, they can easily become the victim of the crime.

A person with any combination of that information has the potential to violate another's PII, he said, but oftentimes, people are careless with their own information. Over the last few years, the DHR Administrative Services Division has had all Fort Rucker forms reviewed by the originating office to have the SSN removed or provide a justification to retain it to help in that regard, said the HR director.

One of the biggest mistakes people make is assuming that recycling bins are safe for disposal of PII, the HR director said. "Those bins are not to be used for placing any type of PII, those items are not secured and once it goes into a recycling bin, that information is no longer protected."

Any type of information that is disposed of in the recycling bins has the potential to be viewed by anyone with access to the bins. From the office, that information can travel miles to the recycling center where it is picked up by an organization outside Fort Rucker. "People are cleaning out their files and not thinking about what could happen putting that information into the recycle bin," he said.

Sparks said that many people also seem to think that if the files they are throwing out are old, then they have no pertinent information in them. This is wrong. Regardless of how old they are, if the files or documents have any type of PII on them, they need to be destroyed properly by shredding.

Most of the organizations and offices on post have shredding machines, and the installation has a high-volume disintegrator ran by the DPTMS, security office that is available to use at the recycling center, he said, so people have no excuse not to properly destroy PII documents.

"We use a disintegrator for paper that will shred documents and turn them into briquettes," said Linda Green, security assistant for the Fort Rucker security division. Essentially, the high-volume disintegrator turns paper into dust and compacts it into briquettes that the recycling center sells for various uses.

The recycling center also houses a CD/DVD destroyer, as well as a hard drive degausser and destroyer, said Heather Androlevich, security assistant for the Fort Rucker security division. The degausser uses high-powered magnets to completely obliterate any data on the hard drives, and for classified hard drives, the hard drives are also physically destroyed to the point they cannot be recovered, she said.

In order to use the equipment, people must take a safety class provided by the security office and set up an appointment at their convenience, and unit training can be accommodated on a case-by-case basis.

To set up a training appointment, people can call 255-3094 or 255-2973.

People found in violation of mishandling PII have the potential to be hit with civil penalties that range from payment of damages and attorney fees to personnel actions that can include termination of employment and possible prosecution, according to officials at the Office of the Staff Judge Advocate. Criminal penalties can also be charged from a $5,000 fine to misdemeanor criminal charges if the violation is severe enough.

"PII violations can be a pretty big deal," said Sparks. "It requires intervention on the part of the operational security manager, as well as the security office to assess the situation and that can all take a lot of time."

The bottom line is people need to make sure to protect PII, said the HR director.